ci: publish dogfood artifacts from red CI runs

[teamleaderleo]

The org-member dogfood build is an optional CI product. Lucas’s #17130 produced a successful exact-head Dogfood build #17130, but unrelated base-owned localization failures made the enclosing CI run red, so the publisher discarded the artifact.

This lets the trusted workflow_run publisher inspect completed pull-request runs and proceed only when all of these are true:

• the current open PR is a same-repository MEMBER or OWNER PR with dev-build
• the exact-head Dogfood build #PR job succeeded
• the matching short-lived GitHub artifact exists and is not expired

Runs without that artifact still exit cleanly without touching R2. This preserves the protected R2 upload and signed-link flow while allowing optional dogfood delivery through unrelated CI failures.

Validation: YAML parsing, actionlint, protected-secret policy, and git diff --check pass.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes the dogfood artifact publisher discarding successful builds when the enclosing CI run is red for unrelated reasons.

The publisher now gates on the exact-head Dogfood build #PR job and its matching artifact instead of the overall run conclusion. Unrelated failing lanes no longer discard a successful dogfood build; runs without a matching artifact still exit cleanly without publishing to R2.

^{Written for commit 15190d0. Summary will update on new commits.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8190e476-5146-4091-b55b-baa690732504

📥 Commits

Reviewing files that changed from the base of the PR and between db77e58 and 15190d0.

📒 Files selected for processing (1)

• .github/workflows/dogfood-artifact-publish.yml

 _______________________________________
< Preventing the Matrix from glitching. >
 ---------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[teamleaderleo]

Audit for --main-fix: Fast static checks remains red only for the base-owned localization parity in Resources/Localizable.xcstrings (machines.new.plan.error has nine untranslated invariant copies). This PR changes only the trusted dogfood publisher gate and does not touch localization. The new workflow passes YAML, actionlint, protected-secret, and registry validation; the publisher now requires a successful exact-head dogfood job plus its matching artifact before using R2.

[github-actions]

Merge receipt for 15190d0309, merged 2026-10-03 21:30:15 UTC

• Not verified at merge: ci-status (not reported), CI fast guards (in progress), Fast static checks (failure), guards (18) (in progress)
• Verified: backend migrations applied, GhosttyKit release check, plan, Web complexity, web-validation
• Skipped by policy: apply-production, apply-staging, browser, Claude wrapper regressions, Dogfood build #​${{ github.event.pull_request.number }}, full-suite-coverage, macos, remote-daemon, suite-coverage, web, web-build, web-database-tests, and 1 more
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.